Internal auditors will have a louder voice in their company come January 1, 2013 — that’s when new revisions to internal-auditor standards drawn up by the Institute of Internal Auditors (IIA) will go into effect.
The standards will give internal auditors, particularly the chief audit executive (CAE), a closer link to a firm’s board, thus raising the importance of the internal auditor as a profession and the profession’s potential usefulness to senior management. The boards at companies that adhere to the revised standards will now have more approval over the internal-audit budget and more authority over the remuneration of the CAE.
“It’s going to give teeth to the internal auditors. They’re not going to be intimidated or cave into management or someone else,” says Salvatore Collemi, quality-control senior manager at accounting firm Rothstein Kass. “Having that ability to stand on their own gives them credibility and the confidence to do their job.”
The reporting lines and day-to-day functions of an internal auditor have varied at companies, depending on the size of a firm and whether an organization is public or private. Some critics say this variability of status often hinders internal auditors’ credibility.
Typically, people in various corporate functions “try to influence where and when internal audit does their work, and if that influence is successful . . . you are probably not in a very effective internal-audit activity,” said Warren Hersh, vice chairman of the IIA’s Internal Audit Standards Board and auditor general for NJ Transit, on a call today outlining the new standards.
The revisions should help to squash some of the discrepancies that have existed over the role of CAEs by putting them more squarely in front of the board. The IIA has said that organizational independence for the CAE is achieved when the person reports “functionally” to the board. Typically, the CAE functionally reports to a corporation’s board of directors via a firm’s audit committee. At the same time, the CAE often had a dotted overall reporting line to a CFO, controller, or other company executive. Corporate-governance experts have often contended that this represents a conflict of interest in which internal auditors examine the work of the executives who determine their pay.
The standards also call for timely adjustments to the internal-audit plan and for ensuring the audit plan outlines the risks of not achieving the CAE’s strategic objectives. Previously, questions existed over the CAE’s role in communicating unacceptable risks to the audit committee. Junior internal-audit staff members are also expected to be in compliance with the standards, not just the CAE.
Better standards, according to Peter Bible, partner-in-charge of the public companies group of EisnerAmper, an audit and accounting firm, should give a needed boost to the professionalism of the internal-audit job. The new standards, he says, are an improvement over the current internal-audit standards available. “It opens the reporting lines,” he says. “It’s catching the entire profession up to that gold standard.”
The revised standards could also provide management with a clearer view of how useful the internal-audit function can be to the company, says Rothstein Kass’s Collemi. “It’s really critical [that the internal auditor] has that support from the ‘tone at the top.’ A lot of times they don’t,” he says. “Management has to view the internal-audit process as not just a cost center but something that adds value and protects the organization.”
While internal-audit best practices, like those the new standards imply, are already in use at some corporations, the revisions make the internal-audit task more uniform across companies. Smaller companies, according to Bible, should benefit the most from the revised standards since they are ones that may not have had a good reporting structure in place for internal auditors compared with larger firms. The IIA’s standards are technically best practices, since the IIA has no regulatory authority to actually enforce them.